Tinfoil HatCatalogFeed statusEvery known security problem in the code packages we track, newest first. It comes from public security databases and updates every few hours. See when it last updated
| Advisory | Severity | Attack odds | Published | Packages |
|---|---|---|---|---|
ZPan Uses Hard-Coded Password CVE-2025-7453, GHSA-2hfh-94w5-wxvf, GO-2026-6014 | Low | Not scored | 11 Jul, 2025 | Go github.com/saltbo/zpan |
Contrast vulnerability allows arbitrary host data Injection into container VOLUME mount points CVE-2025-71424, GHSA-phhq-63jg-fp7r, GO-2025-3807 | Low | Not scored | 09 Jul, 2025 | Go github.com/edgelesssys/contrast |
File Browser's password protection of links is bypassable CVE-2025-52996, GHSA-3v48-283x-f2w4, GO-2025-3790 | Low | Not scored | 30 Jun, 2025 | Go github.com/filebrowser/filebrowser Go github.com/filebrowser/filebrowser/v2 |
Vault Community Edition rekey and recovery key operations can cause denial of service BIT-vault-2025-4656, CVE-2025-4656, GHSA-fhc2-8qx8-6vj7, GO-2025-3788 | Low | Not scored | 26 Jun, 2025 | Go github.com/hashicorp/vault |
Incus Allocation of Resources Without Limits allows firewall rule bypass on managed bridge networks CVE-2025-52889, GHSA-9q7c-qmhm-jv86, GO-2025-3781 | Low | Not scored | 26 Jun, 2025 | Go github.com/lxc/incus Go github.com/lxc/incus/v6 |
Snyk CLI Insertion of Sensitive Information into Log File allowed in DEBUG or DEBUG/TRACE mode CVE-2025-6624, GHSA-6hwc-9h8r-3vmf, GO-2025-3789 | Low | 0.2% | 26 Jun, 2025 | Go github.com/snyk/go-application-framework npm snyk |
kubernetes allows nodes to bypass dynamic resource allocation authorization checks CVE-2025-4563, GHSA-hj2p-8wj8-pfq4, GO-2025-3774 | Low | Not scored | 23 Jun, 2025 | Go k8s.io/kubernetes |
Grafana long dashboard title or panel name causes unresponsives BIT-grafana-2025-1088, CVE-2025-1088, GHSA-crvv-6w6h-cv34, GO-2025-3766 | Low | Not scored | 18 Jun, 2025 | Go github.com/grafana/grafana |
Mattermost allows guest users to view information about public teams they are not members of CVE-2025-4128, GHSA-jwhw-xf5v-qgxc, GO-2025-3757 | Low | Not scored | 11 Jun, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
CIRCL-Fourq: Missing and wrong validation can lead to incorrect results CVE-2025-8556, GHSA-2x5j-vhc8-9cwm, GO-2025-3754 | Low | Not scored | 10 Jun, 2025 | Go github.com/cloudflare/circl |
SpiceDB checks involving relations with caveats can result in no permission when permission is expected CVE-2025-49011, GHSA-cwwm-hr97-qfxm, GO-2025-3744 | Low | Not scored | 06 Jun, 2025 | Go github.com/authzed/spicedb |
Mattermost fails to properly enforce access controls for guest users CVE-2025-1792, GHSA-hc6v-386m-93pq, GO-2025-3730 | Low | Not scored | 30 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost fails to properly enforce access control restrictions for System Manager roles CVE-2025-3611, GHSA-86jg-35xj-3vv5, GO-2025-3728 | Low | Not scored | 30 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Traefik allows path traversal using url encoding CVE-2025-47952, GHSA-vrch-868g-9jx5, GO-2025-3719 | Low | Not scored | 28 May, 2025 | Go github.com/traefik/traefik Go github.com/traefik/traefik/v2 Go github.com/traefik/traefik/v3 |
Ackites KillWxapkg vulnerable to OS Command Injection CVE-2025-5030, GHSA-w6p4-84vc-qc2w, GO-2025-3773 | Low | Not scored | 21 May, 2025 | Go github.com/Ackites/KillWxapkg |
Ackites KillWxapkg Zip Bomb Resource Exhaustion CVE-2025-5031, GHSA-pqqp-7cp8-vxvf, GO-2025-3703 | Low | Not scored | 21 May, 2025 | Go github.com/Ackites/KillWxapkg |
Mattermost Fails to Check User Access to `ExperimentalSettings` CVE-2025-2570, GHSA-fpff-wj6m-grvr, GO-2025-3694 | Low | Not scored | 15 May, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Terraform WinDNS Provider improperly sanitizes input variables in `windns_record` CVE-2025-46735, GHSA-4vgf-2cm4-mp7c, GO-2025-3670 | Low | Not scored | 06 May, 2025 | Go github.com/nrkno/terraform-provider-windns |
Go Snowflake Driver has race condition when checking access to Easy Logging configuration file CVE-2025-46327, GHSA-6jgm-j7h2-2fqg, GO-2025-3650 | Low | Not scored | 28 Apr, 2025 | Go github.com/snowflakedb/gosnowflake |
Mattermost Playbooks fails to properly validate permissions CVE-2025-41423, GHSA-fr22-5377-f3p7, GO-2025-3644 | Low | Not scored | 24 Apr, 2025 | Go github.com/mattermost/mattermost-plugin-playbooks Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 +1 more |
Mattermost doesn't restrict domains LLM can request to contact upstream CVE-2025-31363, GHSA-9h6j-4ffx-cm84, GO-2025-3622 | Low | Not scored | 16 Apr, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Incorrect Authorization vulnerability CVE-2025-24839, GHSA-j639-m367-75cf, GO-2025-3621 | Low | Not scored | 16 Apr, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Missing Authentication for Critical Function CVE-2025-27538, GHSA-j5jw-m2ph-3jjf, GO-2025-3620 | Low | Not scored | 16 Apr, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Incorrect Authorization vulnerability CVE-2025-2424, GHSA-wwhj-pw6h-f8hw, GO-2025-3611 | Low | Not scored | 14 Apr, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Fails to Enforce Proper Access Controls on `/api/v4/audits` Endpoint CVE-2025-24866, GHSA-xfq9-hh5x-xfq9, GO-2025-3604 | Low | Not scored | 10 Apr, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Apache Answer User Using External Images Potentially Discloses User Information CVE-2025-29868, GHSA-wqcc-mfhw-53pc, GO-2025-3587 | Low | Not scored | 01 Apr, 2025 | Go github.com/apache/answer |
Cilium node based network policies may incorrectly allow workload traffic BIT-cilium-2025-30163, BIT-cilium-operator-2025-30163, BIT-hubble-relay-2025-30163, CVE-2025-30163, GHSA-c6pf-2v8j-96mc, GO-2025-3561 | Low | Not scored | 24 Mar, 2025 | Go github.com/cilium/cilium |
Cilium East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers BIT-cilium-2025-30162, BIT-cilium-operator-2025-30162, BIT-hubble-relay-2025-30162, CVE-2025-30162, GHSA-24qp-4xx8-3jvj, GO-2025-3560 | Low | Not scored | 24 Mar, 2025 | Go github.com/cilium/cilium |
Reflected XSS in go-httpbin due to unrestricted client control over Content-Type CVE-2025-45286, GHSA-528q-4pgm-wvg2, GO-2025-3554 | Low | Not scored | 21 Mar, 2025 | Go github.com/mccutchen/go-httpbin Go github.com/mccutchen/go-httpbin/v2 |
Mattermost fail to prompt for explicit approval before adding a team admin to a private channel BIT-mattermost-2025-27715, CVE-2025-27715, GHSA-cw7q-5cgc-h3h9, GO-2025-3555 | Low | Not scored | 21 Mar, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
go-redis allows potential out of order responses when `CLIENT SETINFO` times out during connection establishment CVE-2025-29923, GHSA-92cp-5422-2mw7, GO-2025-3540 | Low | Not scored | 20 Mar, 2025 | Go github.com/redis/go-redis Go github.com/redis/go-redis/v7 Go github.com/redis/go-redis/v8 Go github.com/redis/go-redis/v9 |
Kubernetes kube-apiserver Vulnerable to Race Condition CVE-2024-7598, GHSA-r56h-j38w-hrqq, GO-2025-3547 | Low | Not scored | 20 Mar, 2025 | Go k8s.io/kubernetes Go k8s.io/kubernetes/cmd/kube-apiserver |
Mattermost fails to invalidate all active sessions when converting a user to a bot CVE-2025-1412, GHSA-rhvr-6w8c-6v7w, GO-2025-3482 | Low | Not scored | 24 Feb, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Authelia applies regulation separately to Username-based logins to Email-based logins CVE-2025-24806, GHSA-m5mf-3963-4x26, GO-2025-3468 | Low | Not scored | 19 Feb, 2025 | Go github.com/authelia/authelia Go github.com/authelia/authelia/v4 |
Unencrypted transmission in Temporal api-go library CVE-2025-1243, GHSA-q9w6-cwj4-gf4p, GO-2025-3462 | Low | Not scored | 12 Feb, 2025 | Go go.temporal.io/api |
notation-go has an OS error when setting CRL cache leads to denial of signature verification CVE-2024-51491, GHSA-qjh3-4j3h-vmwp, GO-2025-3382 | Low | Not scored | 13 Jan, 2025 | Go github.com/notaryproject/notation-go |
JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh CVE-2025-22149, GHSA-675f-rq2r-jw82, GO-2025-3376 | Low | Not scored | 09 Jan, 2025 | Go github.com/MicahParks/jwkset |
Mattermost has Improper Check for Unusual or Exceptional Conditions CVE-2025-22445, GHSA-7rgp-4j56-fm79, GO-2025-3380 | Low | Not scored | 09 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Mattermost Incorrect Authorization vulnerability CVE-2025-22449, GHSA-q8fg-cp3q-5jwm, GO-2025-3377 | Low | Not scored | 09 Jan, 2025 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
Simulation of Wasmd message can cause crashing GHSA-vmg2-r3xv-r3xf, GO-2024-3319 | Low | Not scored | 10 Dec, 2024 | Go github.com/CosmWasm/wasmd |
lxd CA certificate sign check bypass CVE-2024-6156, GHSA-4c49-9fpc-hc3v, GO-2024-3312 | Low | Not scored | 09 Dec, 2024 | Go github.com/canonical/lxd |
lxd has a restricted TLS certificate privilege escalation when in PKI mode CVE-2024-6219, GHSA-jpmc-7p9c-4rxf, GO-2024-3313 | Low | Not scored | 09 Dec, 2024 | Go github.com/canonical/lxd |
Apache Answer: Predictable Authorization Token Using UUIDv1 CVE-2024-45719, GHSA-mr95-vfcf-fx9p, GO-2024-3287 | Low | Not scored | 22 Nov, 2024 | Go github.com/apache/incubator-answer |
gitsign may use incorrect Rekor entries during verification CVE-2024-51746, GHSA-8pmp-678w-c8xx, GO-2024-3252 | Low | Not scored | 05 Nov, 2024 | Go github.com/sigstore/gitsign |
LocalAI Cross-site Scripting vulnerability CVE-2024-48057, GHSA-ghx4-cgxw-7h9p, GO-2024-3253 | Low | Not scored | 05 Nov, 2024 | Go github.com/mudler/LocalAI |
Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations CVE-2024-51744, GHSA-29wx-vh33-7x7r, GO-2024-3250 | Low | Not scored | 04 Nov, 2024 | Go github.com/golang-jwt/jwt/v4 |
Grafana org admin can delete pending invites in different org BIT-grafana-2024-10452, CVE-2024-10452, GHSA-66c4-2g2v-54qw, GO-2024-3240 | Low | Not scored | 29 Oct, 2024 | Go github.com/grafana/grafana |
Mattermost incorrectly issues two sessions when using desktop SSO CVE-2024-10214, GHSA-hm57-h27x-599c, GO-2024-3227 | Low | Not scored | 28 Oct, 2024 | Go github.com/mattermost/mattermost-server Go github.com/mattermost/mattermost-server/v5 Go github.com/mattermost/mattermost-server/v6 Go github.com/mattermost/mattermost/server/v8 |
AWS Load Balancer Controller automatically detaches externally associated web ACL from Application Load Balancers GHSA-rjfv-pjvx-mjgv, GO-2024-3212 | Low | Not scored | 24 Oct, 2024 | Go sigs.k8s.io/aws-load-balancer-controller |
SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not CVE-2024-48909, GHSA-3c32-4hq9-6wgj, GO-2024-3200 | Low | Not scored | 14 Oct, 2024 | Go github.com/authzed/spicedb |